Salex Hub Cloud Service L.L.C (“SalexHub”, “we”, “us”), registered in Dubai, United Arab Emirates, operates salexhub.com and the SalexHub platform. This policy explains how we handle personal data.
It covers two different relationships, and which one applies changes your rights and who you exercise them against:
- We are the controller for data about our own visitors, prospects, account holders and their users, billing and support, and for the chat at chat.salexhub.com used without an account. Sections 2 to 13 describe this relationship.
- We are a processor for the data our customers store in their organization (their contacts, deals, emails, form submissions, website telemetry). The customer decides why and how that data is processed; we act on their instructions under our Data Processing Agreement. Section 14 describes this relationship.
If you were contacted by a company that uses SalexHub, or filled in a form on their website, that company, not SalexHub, is the controller of your data. Ask them to access or delete it. If you cannot reach them, write to us and we will pass the request on and tell you who they are, where we may lawfully do so.
1Scope
This policy applies to salexhub.com and its subdomains, to the SalexHub platform at app.salexhub.com, to our APIs and connectors, and to our sales, support and marketing activity. It does not apply to third-party sites we link to, nor to a customer's own website, even where that website runs SalexHub tracking or forms.
Where a customer runs the software on their own infrastructure, that customer operates the deployment and this policy does not apply to data held there.
2Data we collect as controller
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, business email, password hash, organization name, role, language and locale preference, organization settings, invitation records. | You, when registering or being invited. |
| Billing data | Company name, billing contact, purchase and credit-transaction history, invoices, the last four digits and brand of a card, and the payment processor's transaction identifiers. We never receive or store full card numbers. | You, and our payment processor. |
| Usage and diagnostic data | Pages and features used in the product, actions taken, agent runs and the credits they consumed, API calls, error and performance logs, and the audit trail of changes made in an organization. | Automatically, as you use the Service. |
| Device and connection data | IP address, browser and operating system, and approximate country, used for security, abuse prevention and diagnostics. | Automatically, from your requests. |
| Account records | For each organization: its name, its address in the Service (the slug of its URL) and when it was created; its plan and what makes it up (a subscription, or a trial or add-on our staff granted), its subscription status, its trial, grant and renewal dates and whether it renews; the seats it bought and its active members by role; for each limit of its plan, whether it is within it, near it or at it; its AI credit balance, what it spent over the last 7 and 30 days and whether its credits will last 7 or 30 more days at that pace; whether its AI runs on our credits or on its own provider key (the provider's name, never the key); and the last day it was used. Its owners and administrators (name, business email), and anyone who opened a support case, as contacts. Never the records, messages, files or conversations inside the organization, and never counts of them. | The Service, written automatically from billing and account events into our own organization in the Service, which our staff use to support and bill customers. |
| Support and communications | Messages you send us, their attachments, and our replies; call or meeting notes where we take them. | You. |
| Marketing and prospect data | Business contact details of people who ask for a demo, subscribe to our updates or agree to hear from us; the content of that correspondence; and, where you consent to it, whether our emails were opened. | You. |
| Website data | Pages viewed on our marketing site, the referring source, your browser, device type and approximate location, counted in aggregate without a cookie, and how fast each page loaded in your browser. Our marketing site sets no analytics or advertising cookies and loads no third-party trackers or fonts. | Automatically. |
| Chat without an account | Messages you send to the Agent at chat.salexhub.com without an account and its replies, the number of messages sent, and your IP address. We do not store the messages; section 13 explains. | You, and automatically from your requests. |
We do not deliberately collect special categories of personal data (health, biometrics, political or religious views) about our own users, and we ask you not to send them to us in support correspondence.
3Why we use it, and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the Service (creating organizations, authenticating users, running features you invoke) | Account, usage, device | Performance of a contract |
| Answering messages in the chat without an account, and limiting how many one browser or address can send | Chat, device | Performance of a contract (the Terms you accept by sending a message) for the answers; legitimate interests in keeping a free service available for the limits |
| Billing, credits and collections | Billing, account, usage | Performance of a contract; legal obligation for tax and accounting records |
| Security, abuse prevention, rate limiting and fraud detection | Device, usage, account | Legitimate interests in keeping the Service and its users safe |
| Account management: knowing which organizations we serve, on which plan, and how close each is to the limits of what it bought, so we can answer its support cases, renew and bill it correctly, and tell its owners before a limit stops their work | Account records, account, billing | Performance of a contract where you accepted the Terms yourself; otherwise our legitimate interests in serving the organization you administer. Where the UAE PDPL applies: the contract with your organization and our obligations under UAE law (Article 4) |
| Support and service communications (outages, security notices, changes to terms) | Account, support | Performance of a contract; legitimate interests |
| Improving and developing the product (aggregate statistics, diagnostics, adoption analysis) | Usage, diagnostic, de-identified statistics | Legitimate interests in improving a service our customers pay for |
| Marketing to businesses and prospects | Marketing, account | Consent, recorded where you gave it and withdrawn at any time; every marketing message carries an unsubscribe link. Support replies, billing and security notices are service messages, not marketing: they are sent under the purposes above and carry no unsubscribe link. |
| Complying with law, responding to lawful requests, establishing or defending legal claims | Any of the above, as needed | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and freedoms; you can ask us for that assessment, and you can object at any time (section 10).
We do not make decisions producing legal or similarly significant effects about you solely by automated means.
4AI processing
The Service includes AI features. When a feature runs, what it needs from the organization to answer (the prompt, the records in scope, retrieved documents and the conversation so far) is sent to a model provider acting as our subprocessor, or to a provider whose key the customer supplied.
- Our providers are contractually barred from training on data we send them on a customer's behalf.
- Messages sent in the chat at chat.salexhub.com without an account are not sent on a customer's behalf. Free models answer them, and their providers make no such commitment; section 13 explains.
- Content is sent only as needed to produce the result asked for, and only within the permissions of the person or key the agent acts for.
- Prompts, results, tool calls and the credits consumed are recorded in the organization so a run can be audited; those transcripts are retained as set out in section 8.
- Where a customer configures their own provider key, that provider's terms govern the processing, and our no-training commitment may not apply.
The AI Terms describe how agents work, what they may act on, and the limits of model output. Current providers are listed on the Subprocessors page.
7Where data is stored and international transfers
The primary database holding organization data is located in the European Union (Frankfurt, Germany). Files are stored in object storage in the European Union. The application runs in Frankfurt, Germany, behind a global edge network that routes and caches requests and checks sign-in sessions close to the visitor.
Some subprocessors, notably model providers and our payment processor, process data in the United States or other countries. We are established in the United Arab Emirates. This means personal data may be transferred outside the country where it was collected.
For transfers of data protected by European, UK or Swiss law we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, and we assess each transfer for the protection actually available in the destination. Copies are available on request at start@salexhub.com.
The product carries a data-residency configuration (EU, US, Middle East). Today all organizations are served from the European Union location above; regional storage is a roadmap capability, and we do not promise it until an organization is actually provisioned in that region under a written commitment.
8How long we keep data
We keep personal data only as long as needed for the purpose it was collected for, then delete or de-identify it. Deletion at the end of these periods is not yet automatic (see the Security Overview). Defaults for the Service, which a customer may shorten in the configuration of their organization:
| Data | Default retention |
|---|---|
| Records and files in an organization (customer-controlled content) | For the life of the organization, then as in section 9 |
| Deleted records and files (recycle bin) | 30 days, then permanently deleted |
| Field-level change history | 24 months |
| Website analytics events | 13 months |
| Behavioural signals about known contacts | 90 days |
| AI prompts, results and run transcripts | 90 days |
| In-product notifications, once read | 180 days |
| Outbound event and webhook delivery logs | 30 days (14 days for undeliverable events) |
| Security and access logs | 12 months |
| Billing records, invoices and tax documentation | As required by law, typically 5–7 years |
| Support correspondence | 24 months after the case closes |
| Account records of an organization | While the organization exists; after it closes, billing and tax records as the law requires (above), a contact named on a support case with that case (24 months), and the rest deleted within the thirty (30) days of section 9 |
| Marketing contact records | Until you withdraw consent or unsubscribe, then a minimal suppression record so we do not contact you again |
| The chat without an account | Messages are not stored by us; the message count 30 days; the IP address until the next daily clean-up (section 13) |
Backups follow their own cycle and are overwritten on a rolling basis; data deleted from the live system disappears from backups as those backups age out. Where we must keep something for a legal claim or obligation, we isolate and restrict it rather than continue using it.
9Account closure and deletion
You can export your records from the product at any time, and ask us for a complete export of the organization. To close an organization in the Service, an owner writes to us: we hand back a complete export, keep it available for thirty (30) days, and then delete the organization's data, except records we must retain by law (billing and tax documentation) and the record of the erasures carried out in the organization (identifiers and dates, no personal data). On request we confirm the deletion in writing.
Individual erasure requests inside an organization are handled by the customer using the erasure tools we provide; the effect is immediate in the product, and the physical removal, including from derived stores and search indexes, completes asynchronously.
10Your rights
Subject to your local law, you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to processing; port it to another provider; and withdraw consent where we relied on consent. You will not be treated differently for exercising a right.
To exercise a right, write to start@salexhub.com with the subject “Privacy”. We answer within thirty (30) days, or sooner where the law requires, and may ask for information to verify your identity. We use such information only for that purpose.
European Economic Area, United Kingdom and Switzerland
You have the rights in Articles 15–22 GDPR (and the UK and Swiss equivalents), including the right to lodge a complaint with your supervisory authority. We ask that you contact us first so we can put things right.
United Arab Emirates
Where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, you have rights of access, correction, erasure, restriction, portability, and objection to processing, and may complain to the UAE Data Office.
California
If you are a California resident, you may request the categories and specific pieces of personal information we collected, the purposes, and the categories of recipients; request deletion or correction; and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months.
Other regions
Where local law grants rights beyond those listed here (for example in Brazil, Canada, Saudi Arabia or Australia), we honour them for people in those places.
11Security
We encrypt data in transit with TLS and at rest, isolate tenants at the data-access layer, encrypt stored third-party credentials with an envelope key, restrict production access to those who need it, and log administrative actions. Details are in the Security Overview.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and, where required, the competent authority, without undue delay.
To report a vulnerability, write to start@salexhub.com with the subject “Security”. We will not pursue good-faith researchers who follow the guidance in the Security Overview.
12Children
The Service is a business tool, not directed to children, and we do not knowingly collect personal data from anyone under 18 as a user. If you believe a child has provided us personal data, write to us and we will delete it.
13The chat without an account
At chat.salexhub.com anyone can send the Agent five messages without creating an account. We are the controller of those messages. Without an account the Agent has no tools and no access to anyone's organization: it answers from what it knows about SalexHub.
| Data | Why, and the legal basis | How long |
|---|---|---|
| Your messages and the Agent's replies | To answer you. Performance of a contract: the Terms you accept by sending a message. | Not stored on our servers. Your browser keeps the conversation until you clear it. The company running the model keeps what it receives as its own terms allow. |
| The number of messages you have sent | To stop at five and offer you an account. Legitimate interests in keeping a free service available. | In a cookie that expires 30 days after the last message answered. |
| Your IP address | To limit how many messages one address can send in a minute. Legitimate interests in preventing abuse. | In a per-minute counter in our database, deleted by a daily clean-up. |
The chat runs on free AI models, and the commitments in section 4 do not apply to it. Your messages pass through our network and hosting providers (Cloudflare and Vercel) to our application, which sends each one, with the conversation so far, through Vercel's AI Gateway to a free model run by another company. That company processes them under its own terms, which do not promise to delete them or not to use them to train its models, and it may process them outside your country, including outside the European Union. The models and companies in use are listed on our Subprocessors page.
Do not send personal data about yourself or anyone else, or anything confidential. If a message does name another person, we process that only to answer you, on the basis of legitimate interests.
We do not keep your messages: our application passes them to the model, returns the answer and writes neither to our database, so no one at SalexHub reads them. The conversation you see is kept in your browser's local storage, and each new message sends it along so the Agent can answer in context. To delete it, clear the site data for chat.salexhub.com. The cookie and the local storage are described in the Cookie Policy.
Because we hold no copy of a conversation, we cannot find, show or delete one for you; for what a model's provider keeps, its own terms apply. Signing up does not move the conversation into an organization. Once you sign in, chat.salexhub.com shows the Agent of your organization, and the rest of this policy applies to it as to the Service.
14Data our customers store in the product
For personal data our customers put into their organization (their contacts, the recipients of their emails, visitors to their websites, people who submit their forms), the customer is the controller and we are the processor. We process it only on their instructions, under the Data Processing Agreement.
This includes data reaching us through features the customer switches on:
- Mailbox connection. Where a customer connects a mailbox over IMAP/SMTP, we synchronise messages so that correspondence appears against records. The customer is responsible for having the right to do so and for informing the people concerned.
- Website analytics. Our tracker is cookieless: a visitor is identified by a hash computed from a daily rotating salt, so the identifier cannot be linked across days, and it stores no IP address, only an approximate country derived at the edge. The customer decides what to track and must publish their own notice.
- Forms and embedded components. What a visitor submits is stored verbatim for the customer, and may become a contact record in their organization.
- Documents and quotes shared by link. Views of a shared document are recorded for the customer who shared it.
If you want your data accessed, corrected or deleted by such a customer, contact them directly. We will assist them in responding, and will forward a request to them where you cannot identify who they are.
When our support may see inside an organization. Our staff have no standing access to the records in an organization. When someone in an organization contacts our support, the member of our staff assigned to their case may ask, in that case, to see the organization; only if the person who opened the case allows it can they see it, read-only and as that person sees it, until the case is solved or closed or for at most seven days, whichever comes first. That person can withdraw it at any time, and an administrator can turn these requests off for the whole organization in Settings > Security, which also ends any access under way. Every page, record, list and file our staff open is written to the organization's audit log with their name, the IP address and the browser they used. Values the organization keeps encrypted are never shown to them.
15Changes to this policy
We update this policy as the product and the law change. The date at the top always reflects the current version. For material changes we give at least thirty (30) days' notice by email to account administrators or by notice in the product before the change takes effect.
16Contact
Salex Hub Cloud Service L.L.C, Dubai, United Arab Emirates.
Privacy enquiries and rights requests: start@salexhub.com with the subject “Privacy”.
We have not appointed a statutory data protection officer, and we will do so if the law requires it. Requests reach the people responsible for privacy at the address above.